feat(tui): preselect suggested permission scope

Thread `suggestedScope` through the app-server permission approval
request and use it when constructing TUI approval requests. This
keeps the protocol backward compatible by defaulting the field to
`turn` when older clients omit it.

Add focused app-server and TUI coverage, plus a snapshot for the
session-suggested approval overlay so reviewers can see the
preselected session row.

codex-rs/app-server-protocol/schema/json/ServerRequest.json

@@ -1344,6 +1344,13 @@
         }
       ]
     },
+    "PermissionGrantScope": {
+      "enum": [
+        "turn",
+        "session"
+      ],
+      "type": "string"
+    },
     "PermissionsRequestApprovalParams": {
       "properties": {
         "itemId": {
@@ -1358,6 +1365,14 @@
             "null"
           ]
         },
+        "suggestedScope": {
+          "allOf": [
+            {
+              "$ref": "#/definitions/PermissionGrantScope"
+            }
+          ],
+          "default": "turn"
+        },
         "threadId": {
           "type": "string"
         },